A health tech enterprise wants to ensure that its in-house developed mobile app for users complies with data privacy regulations. Which of the following should be identified FIRST when creating an inventory of information systems and data related to the mobile app?
Correct Answer: C
This should be identified first when creating an inventory of information systems and data related to the mobile app, as they are the individuals or groups who have the authority and responsibility to define, classify, protect, and manage the data assets of the enterprise1. By identifying the application and data owners, the enterprise can ensure that the data is properly accounted for, categorized, and secured according to its value, sensitivity, and risk. Application and data owners can also establish data policies, standards, and procedures, as well as monitor and report on data quality, usage, and compliance1. Identifying the application and data owners is a prerequisite for identifying the other options, such as data maintained by vendors, vendors and outsourced systems, and information classification scheme, as these depend on the accurate identification and assignment of data ownership roles and responsibilities.